34d727e0ea42190f49af34b0326f7f8c86144b2fb6ea8854cc617e28dc81f6fb

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup Ozone 8 v8.0.2.msi
Size 789.6MB
Sample260922-vna4ysbb49
SHA256 34d727e0ea42190f49af34b0326f7f8c86144b2fb6ea8854cc617e28dc81f6fb
MD5 9deeeeeb08305a7d088ab6ef845135c3
SHA1 83617f0b71fe7ee75c4f5870ef8de0f0c0a8348c
SHA512 5d4a31d333964e408689a559ffe9b8a66a64dd2c107bf2b5b033590466bd506a3195c9d988bfdb9fff5484a5d63f10401dcd8d9c8ecbcda47de0acbdabe04648
SSDEEP 25165824:WWvFXeTD0q4QyBsZg+Yle4NBiDT7LGBXttYNU:WcXeTg6dile7KBdtYNU
TLSH
T13689332BF4592F2EC65BA8FAD13A4A36047E3A430B255C42332D6B217AD76B317F0751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\VBoxDrv.sys	msiexec.exe
File created	C:\Windows\system32\drivers\VBoxUSBMon.sys	msiexec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET5ABF.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET5ABF.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxDrv.sys	MsiExec.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5BDEFE580A816661CDB57A57107BF4187486EFCC\Blob = 0300000001000000140000005bdefe580a816661cdb57a57107bf4187486efcc6b000000010000002000000075e96bab78e894c582d115f74392d87213222e3356f858161d33f0f9719a05e9140000000100000014000000eca03bfeb314734af1b86400574aca7a3b79af3d1900000001000000100000001f24a0b333c7ca26d6ee9b1b348160e40f0000000100000014000000f7c4b6949aa82630fc59593e9f20865e3e8dd17320000000010000001705000030820513308203fba003020102021065d365a24ee7e137105bbac2335816d8300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3136313231343030303030305a170d3139303331353233353935395a3075310b30090603550406130255533113301106035504080c0a43616c69666f726e69613117301506035504070c0e526564776f6f642053686f726573311b3019060355040a0c124f7261636c6520436f72706f726174696f6e311b301906035504030c124f7261636c6520436f72706f726174696f6e30820122300d06092a864886f70d01010105000382010f003082010a0282010100979a1345945d4cc20eee7f9380e71ec7e1ed679703a4fdbc5344f5c74748ccdebed121aeca6a637c9311ec68645a2faf9458f20022ac3f2a3c1d18b7483a8108fdd0de5c44cea23466f7cdf9585bc316c6b6ee91385282d65722b26601ff43fd31accda01b14e4abafef5942d6aad08d62fd0accd836177c4c26dab27d83c6a0a9dd493bf74caefd6a0b1a84c7ee40aa4e16335e9492f23ca023ebdb45e316c8c367bb76d07778f6d590a26ef007afb6d6911669a34bd38f1025a38c0587d1842f405d31be2b05123f782ead22a08c528e63a86ac8bb8d06efae2405d32d6c58da9c83fd39b04dd08da52bde3744d034aaca55ea3581eea30ab7d300e6aee8010203010001a382015d3082015930090603551d1304023000300e0603551d0f0101ff040403020780302b0603551d1f042430223020a01ea01c861a687474703a2f2f73662e73796d63622e636f6d2f73662e63726c30610603551d20045a30583056060667810c010401304c302306082b06010505070201161768747470733a2f2f642e73796d63622e636f6d2f637073302506082b0601050507020230190c1768747470733a2f2f642e73796d63622e636f6d2f72706130130603551d25040c300a06082b06010505070303305706082b06010505070101044b3049301f06082b060105050730018613687474703a2f2f73662e73796d63642e636f6d302606082b06010505073002861a687474703a2f2f73662e73796d63622e636f6d2f73662e637274301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301d0603551d0e04160414eca03bfeb314734af1b86400574aca7a3b79af3d300d06092a864886f70d01010505000382010100d8e900efe4dd37ed9b23ba73edb93b2a4cea4e8f02cca9ce5075906742fb5b092131e3f027b8574ea91fde7ac36f6809386e7f671853e569848c4682e681e2fd79244a113907e8a10c81fb68923bb85666c9c0db73b83f1f8a5ebaece61be3eb5d25ae90c0d8ff489c411c8f45ffa97b7e659e9b701533ec195de9d25af0e5f0306f0beecb848ae44928645829c808a7a50e765e4181717d0fe2b2b9220bd82a65b2eeae9c226178c02b272dbd6d5ddd3746fef0e74b552616da11bd266ed865258e074f224d21b619f0d6c1a5a14a2ea99b65ee9f1bfe7651bcc973cacd90e03dab24233243e7cfd9ae751b7c12c25e35bf9b11835c36fda6a0e3ebbc764850	DrvInst.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3124	attrib.exe
3748	attrib.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxDrv\ImagePath = "\\SystemRoot\\system32\\DRIVERS\\VBoxDrv.sys"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxNetLwf\ImagePath = "\\SystemRoot\\system32\\DRIVERS\\VBoxNetLwf.sys"	msiexec.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 9 IoCs

pid	Process
108	MSIBB74.tmp
4272	MSI69E0.tmp
4216	VBoxManage.exe
2104	VBoxSVC.exe
4304	VBoxManage.exe
5348	VmServiceControl.exe
5044	MSI7839.tmp
4576	MSI79D0.tmp
3216	VBoxVmService64.exe

Loads dropped DLL 39 IoCs

pid	Process
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
3316	MsiExec.exe
3316	MsiExec.exe
3316	MsiExec.exe
3316	MsiExec.exe
3316	MsiExec.exe
3316	MsiExec.exe
3316	MsiExec.exe
5880	MsiExec.exe
4888	MsiExec.exe
4888	MsiExec.exe
4888	MsiExec.exe
4216	VBoxManage.exe
4216	VBoxManage.exe
4216	VBoxManage.exe
4216	VBoxManage.exe
4216	VBoxManage.exe
4216	VBoxManage.exe
4216	VBoxManage.exe
2104	VBoxSVC.exe
2104	VBoxSVC.exe
2104	VBoxSVC.exe
2104	VBoxSVC.exe
2104	VBoxSVC.exe
4304	VBoxManage.exe
4304	VBoxManage.exe
4304	VBoxManage.exe
4304	VBoxManage.exe
4304	VBoxManage.exe
4304	VBoxManage.exe
2104	VBoxSVC.exe
5880	MsiExec.exe
4888	MsiExec.exe
4888	MsiExec.exe
4888	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	MSIBB74.tmp
File opened (read-only)	\??\U:	MSIBB74.tmp
File opened (read-only)	\??\X:	MSIBB74.tmp
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	MSIBB74.tmp
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	MSIBB74.tmp
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	MSIBB74.tmp
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	MSIBB74.tmp
File opened (read-only)	\??\J:	MSIBB74.tmp
File opened (read-only)	\??\T:	MSIBB74.tmp
File opened (read-only)	\??\Z:	MSIBB74.tmp
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	MSIBB74.tmp
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	MSIBB74.tmp
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	MSIBB74.tmp
File opened (read-only)	\??\N:	MSIBB74.tmp
File opened (read-only)	\??\W:	MSIBB74.tmp
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	MSIBB74.tmp
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	MSIBB74.tmp
File opened (read-only)	\??\H:	MSIBB74.tmp
File opened (read-only)	\??\S:	MSIBB74.tmp
File opened (read-only)	\??\M:	MSIBB74.tmp
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	MSIBB74.tmp
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	MSIBB74.tmp

Drops file in System32 directory 57 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{000f3531-6ba7-0e45-a2a8-e6a8ed56b6b5}\SET3B41.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e84bc82-43eb-2449-a00a-fa2906bef638}\SET583E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4e84bc82-43eb-2449-a00a-fa2906bef638}\SET583F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{000f3531-6ba7-0e45-a2a8-e6a8ed56b6b5}\VBoxNetAdp6.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{000f3531-6ba7-0e45-a2a8-e6a8ed56b6b5}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{000f3531-6ba7-0e45-a2a8-e6a8ed56b6b5}\SET3B41.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9574bab5159a1997\VBoxNetLwf.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\DRVSTORE	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_7FEC5776E5FF8B91C624DB61FDAA648A05638EB8\VBoxDrv.cat	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{000f3531-6ba7-0e45-a2a8-e6a8ed56b6b5}\SET3B52.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9574bab5159a1997\VBoxNetLwf.inf	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_7FEC5776E5FF8B91C624DB61FDAA648A05638EB8\VBoxDrv.sys	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{000f3531-6ba7-0e45-a2a8-e6a8ed56b6b5}\VBoxNetAdp6.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_f0c7ebe4311c787f\VBoxNetAdp6.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e84bc82-43eb-2449-a00a-fa2906bef638}\VBoxNetLwf.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9574bab5159a1997\VBoxNetLwf.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{000f3531-6ba7-0e45-a2a8-e6a8ed56b6b5}\SET3B40.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	rundll32.exe
File created	C:\Windows\System32\DriverStore\Temp\{4e84bc82-43eb-2449-a00a-fa2906bef638}\SET583E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e84bc82-43eb-2449-a00a-fa2906bef638}	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	rundll32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e84bc82-43eb-2449-a00a-fa2906bef638}\SET5840.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9574bab5159a1997\VBoxNetLwf.sys	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\.VirtualBox\VirtualBox.xml-tmp	VBoxSVC.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_f0c7ebe4311c787f\VBoxNetAdp6.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4e84bc82-43eb-2449-a00a-fa2906bef638}\SET5840.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e84bc82-43eb-2449-a00a-fa2906bef638}\VBoxNetLwf.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_f0c7ebe4311c787f\VBoxNetAdp6.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_7FEC5776E5FF8B91C624DB61FDAA648A05638EB8\VBoxDrv.inf	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	rundll32.exe
File created	C:\Windows\system32\config\systemprofile\.VirtualBox\VBoxSVC.log	VBoxSVC.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_f0c7ebe4311c787f\VBoxNetAdp6.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{000f3531-6ba7-0e45-a2a8-e6a8ed56b6b5}\VBoxNetAdp6.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e84bc82-43eb-2449-a00a-fa2906bef638}\VBoxNetLwf.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e84bc82-43eb-2449-a00a-fa2906bef638}\SET583F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{000f3531-6ba7-0e45-a2a8-e6a8ed56b6b5}\SET3B52.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_f0c7ebe4311c787f.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9574bab5159a1997.ini	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\.VirtualBox	VBoxSVC.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{000f3531-6ba7-0e45-a2a8-e6a8ed56b6b5}\SET3B40.tmp	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-triode-352800.000000.dat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel5_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxEFI32.fd	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxProxyStub-x86.dll	msiexec.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\iZotope\iZOzone8VintageEQAAXHook.aaxplugin\Contents\x64\iZOzone8VintageEQ.dll	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\win64\tag.dll	msiexec.exe
File created	C:\Program Files (x86)\VSTPlugIns\iZotope\iZOzone8.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VST3\iZotope\Ozone 8 Vintage Tape.vst3	msiexec.exe
File created	C:\Program Files\Steinberg\VSTPlugins\iZotope\Ozone 8 Dynamics.dll	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-triode-512000.000000.dat	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-triode-768000.000000.dat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ca.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll	msiexec.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\iZotope\iZOzone8AAXHook.aaxplugin\Contents\x64\iZOzone8.dll	msiexec.exe
File created	C:\Program Files\Common Files\VST3\iZotope\Ozone 8 Equalizer.vst3	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-dualtriode-192000.000000.dat	msiexec.exe
File created	C:\Program Files (x86)\VSTPlugIns\iZotope\iZOzone8Imager.dll	msiexec.exe
File created	C:\Program Files (x86)\VSTPlugIns\iZotope\Ozone 8 Maximizer.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf	msiexec.exe
File created	C:\Program Files (x86)\VSTPlugIns\iZotope\Ozone 8 Dynamics.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_fr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ja.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_el.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qoffscreen.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxWebSrv.exe	msiexec.exe
File created	C:\Program Files\Steinberg\VSTPlugins\iZotope\iZOzone8DynEq.dll	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-dualtriode-32000.000000.dat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_eu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\win_nt5_unattended.sif	msiexec.exe
File created	C:\Program Files\Common Files\VST3\iZotope\Ozone 8 Imager.vst3	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-triode-11025.000000.dat	msiexec.exe
File created	C:\Program Files (x86)\VSTPlugIns\iZotope\Ozone 8 Vintage EQ.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_de.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ko.qm	msiexec.exe
File created	C:\Program Files\Common Files\VST3\iZotope\iZOzone8VintageLimiter.dll	msiexec.exe
File created	C:\Program Files\Steinberg\VSTPlugins\iZotope\Ozone 8 Vintage Limiter.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxC.dll	msiexec.exe
File created	C:\Program Files (x86)\VSTPlugIns\iZotope\Ozone 8 Equalizer.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_bg.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\SDL.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetDHCP.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.sys	msiexec.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\iZotope\iZOzone8ExciterAAXHook.aaxplugin\Contents\x64\iZOzone8ExciterAAXHook.aaxplugin	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDbg.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxRes.dll	msiexec.exe
File created	C:\Program Files\Common Files\VST3\iZotope\Ozone 8.vst3	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VST3\iZotope\Ozone 8 Dynamic EQ.vst3	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-dualtriode-96000.000000.dat	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\oz8_icon.ico	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ru.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\install\vboxapisetup.py	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSharedCrOpenGL.dll	msiexec.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\iZotope\iZOzone8VintageTapeAAXHook.aaxplugin\Contents\x64\iZOzone8VintageTapeAAXHook.aaxplugin	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VST3\iZotope\Ozone 8 Exciter.vst3	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-triode-192000.000000.dat	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-triode-96000.000000.dat	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\win64\iZotope Ozone 8.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_es.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel3_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox.dll	msiexec.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\iZotope\iZOzone8DynamicsAAXHook.aaxplugin\Contents\x64\iZOzone8DynamicsAAXHook.aaxplugin	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5a7f66.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A265742B-FABD-4816-A8BE-8C40F5642200}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79D0.tmp	msiexec.exe
File created	C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\unins000.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI69E0.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD68FC4D6A98EAD90.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}	msiexec.exe
File created	C:\Windows\Installer\e5a7f65.msi	msiexec.exe
File opened for modification	C:\Windows\INF\cpu.PNF	msiexec.exe
File created	C:\Windows\INF\termkbd.PNF	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\SystemTemp\~DF8FB0D831F6FD09F8.TMP	msiexec.exe
File created	C:\Windows\INF\oem11.PNF	msiexec.exe
File opened for modification	C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\unins000.exe	msiexec.exe
File created	C:\Windows\INF\oem3.PNF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5974.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a7f63.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E45.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a7f63.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB74.tmp	msiexec.exe
File created	C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\iZotopeOzone8.exe	msiexec.exe
File created	C:\Windows\INF\disk.PNF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A42.tmp	msiexec.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI7839.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6F053E0A50FAAE64.TMP	msiexec.exe
File created	C:\Windows\INF\oem12.inf	msiexec.exe
File created	C:\Windows\INF\oem12.PNF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E85.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6FF.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI14E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI235D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI57CD.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\iZotopeOzone8_1.exe	msiexec.exe
File opened for modification	C:\Windows\INF\termkbd.PNF	msiexec.exe
File created	C:\Windows\INF\cpu.PNF	msiexec.exe
File created	C:\Windows\INF\oem11.inf	msiexec.exe
File created	C:\Windows\INF\oem3.inf	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\iZotopeOzone8.exe	msiexec.exe
File created	C:\Windows\Installer\e5a7f66.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1530.tmp	msiexec.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIB8F1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1580.tmp	msiexec.exe
File created	C:\Windows\INF\termmou.PNF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7AFA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E65.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB95F.tmp	msiexec.exe
File created	C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\iZotopeOzone8_1.exe	msiexec.exe
File opened for modification	C:\Windows\INF\disk.PNF	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8CADF71ED79C9AA3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2020.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1560.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8A24B9146BAFD54A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF59ACA9DD0A8D9DCF.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5836	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VmServiceControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI7839.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIBB74.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI79D0.tmp

Checks SCSI registry key(s) 3 TTPs 53 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fa6709e762e3d5140000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801fa6709e70000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101fa6709e7000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3fa6709e700000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6fa6709e700000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MSI79D0.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MSI69E0.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MSI7839.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MSI69E0.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MSI79D0.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EE3CBCB-486F-40DB-9150-DEEE3FD24189}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49B19D41-4A75-7BD5-C124-259ACBA3C41D}\ = "IStorageController"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{715212BF-DA59-426E-8230-3831FAA52C56}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F63597A-26F1-4EDB-8DD2-6BDDD0912368}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE8A0EB5-F4F4-4DD0-9D30-C89B873247EC}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFCA788C-4477-787D-60B2-3FA70E56FBBC}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B2F98F8-9641-4397-854A-040439D0114B}\ = "IGuestScreenInfo"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{316C99A2-405D-41AF-8508-46889144D067}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F05D7E60-1BCF-4218-9807-04E036CC70F1}\ = "IProgressPercentageChangedEvent"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{431685da-3618-4ebc-b038-833ba829b4b2}	VBoxManage.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00C8F974-92C5-44A1-8F3F-702469FDD04B}\NumMethods	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8C25D4D-AC97-4C16-B3E2-81BD8A57CC27}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9709DB9B-3346-49D6-8F1C-41B0C4784FF2}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{715212BF-DA59-426E-8230-3831FAA52C56}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DEDFB5D9-4C1B-EDF7-FDF3-C1BE6827DC28}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7932CB8-F6D4-4AB6-9CBF-558EB8959A6A}\ProxyStubClsid32	VBoxManage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20479EAF-D8ED-44CF-85AC-C83A26C95A4D}\TypeLib	VBoxManage.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{813C99FC-9849-4F47-813E-24A75DC85615}\NumMethods	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DDEF35E-4737-457B-99FC-BC52C851A44F}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D23A9CA3-42DA-C94B-8AEC-21968E08355D}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{49B19D41-4A75-7BD5-C124-259ACBA3C41D}\ = "IStorageController"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DA2DEC7-71B2-4817-9A64-4ED12C17388E}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8398F026-4ADD-4474-5BC3-2F9F2140B23E}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45587218-4289-EF4E-8E6A-E5B07816B631}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10F337FB-422E-E57E-661B-0998AC309175}\NumMethods	VBoxManage.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CDBC59DF-4F4D-4CF2-809C-917601355AFC}\NumMethods	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D0D93830-70A2-487E-895E-D3FC9679F7B3}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{179F8647-319C-4E7E-8150-C5837BD265F6}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13A11514-402E-022E-6180-C3944DE3F9C8}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F2F7FAE4-4A06-81FC-A916-78B2DA1FA0E5}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27C0B3D-6038-422C-B45E-6D4A0503D9F1}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE8A0EB5-F4F4-4DD0-9D30-C89B873247EC}\ = "IGuestMultiTouchEvent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5748F794-48DF-438D-85EB-98FFD70D18C9}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{334DF94A-7556-4CBC-8C04-043096B02D82}\ = "IBandwidthGroupChangedEvent"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{747E397E-69C8-45A0-88D9-F7F070960718}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C19073DD-CC7B-431B-98B2-951FDA8EAB89}\NumMethods	VBoxManage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49B19D41-4A75-7BD5-C124-259ACBA3C41D}\TypeLib	VBoxManage.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85CD948E-A71F-4289-281E-0CA7AD48CD89}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DEDFB5D9-4C1B-EDF7-FDF3-C1BE6827DC28}\NumMethods	VBoxManage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.Session.1	VBoxManage.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01ADB2D6-AEDF-461C-BE2C-99E91BDAD8A1}\NumMethods	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{179F8647-319C-4E7E-8150-C5837BD265F6}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C365FB7B-4430-499F-92C8-8BED814A567A}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{245D88BD-800A-40F8-87A6-170D02249A55}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9570B9D5-F1A1-448A-10C5-E12F5285ADAD}\NumMethods	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9709DB9B-3346-49D6-8F1C-41B0C4784FF2}\NumMethods	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4132147B-42F8-CD96-7570-6A8800E3342C}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91F33D6F-E621-4F70-A77E-15F0E3C714D5}\ = "IPCIDeviceAttachment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DA2DEC7-71B2-4817-9A64-4ED12C17388E}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{883DD18B-0721-4CDE-867C-1A82ABAF914C}\TypeLib\Version = "1.3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31587F93-2D12-4D7C-BA6D-CE51D0D5B265}\NumMethods	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D947ADF5-4022-DC80-5535-6FB116815604}\NumMethods	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6DCF6E8-416B-4181-8C4A-45EC95177AEF}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D0D93830-70A2-487E-895E-D3FC9679F7B3}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFCA788C-4477-787D-60B2-3FA70E56FBBC}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F7B8A22-C71F-4A36-8E5F-A77D01D76090}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{88394258-7006-40D4-B339-472EE3801844}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48C7F4C0-C9D6-4742-957C-A6FD52E8C4AE}\ = "IBandwidthControl"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{872DA645-4A9B-1727-BEE2-5585105B9EED}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DFA7E4F5-B4A4-44CE-85A8-127AC5EB59DC}\NumMethods	VBoxManage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{316C99A2-405D-41AF-8508-46889144D067}\NumMethods	VBoxManage.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
808	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	952	msiexec.exe
Token: SeIncreaseQuotaPrivilege	952	msiexec.exe
Token: SeSecurityPrivilege	1092	msiexec.exe
Token: SeCreateTokenPrivilege	952	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	952	msiexec.exe
Token: SeLockMemoryPrivilege	952	msiexec.exe
Token: SeIncreaseQuotaPrivilege	952	msiexec.exe
Token: SeMachineAccountPrivilege	952	msiexec.exe
Token: SeTcbPrivilege	952	msiexec.exe
Token: SeSecurityPrivilege	952	msiexec.exe
Token: SeTakeOwnershipPrivilege	952	msiexec.exe
Token: SeLoadDriverPrivilege	952	msiexec.exe
Token: SeSystemProfilePrivilege	952	msiexec.exe
Token: SeSystemtimePrivilege	952	msiexec.exe
Token: SeProfSingleProcessPrivilege	952	msiexec.exe
Token: SeIncBasePriorityPrivilege	952	msiexec.exe
Token: SeCreatePagefilePrivilege	952	msiexec.exe
Token: SeCreatePermanentPrivilege	952	msiexec.exe
Token: SeBackupPrivilege	952	msiexec.exe
Token: SeRestorePrivilege	952	msiexec.exe
Token: SeShutdownPrivilege	952	msiexec.exe
Token: SeDebugPrivilege	952	msiexec.exe
Token: SeAuditPrivilege	952	msiexec.exe
Token: SeSystemEnvironmentPrivilege	952	msiexec.exe
Token: SeChangeNotifyPrivilege	952	msiexec.exe
Token: SeRemoteShutdownPrivilege	952	msiexec.exe
Token: SeUndockPrivilege	952	msiexec.exe
Token: SeSyncAgentPrivilege	952	msiexec.exe
Token: SeEnableDelegationPrivilege	952	msiexec.exe
Token: SeManageVolumePrivilege	952	msiexec.exe
Token: SeImpersonatePrivilege	952	msiexec.exe
Token: SeCreateGlobalPrivilege	952	msiexec.exe
Token: SeCreateTokenPrivilege	952	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	952	msiexec.exe
Token: SeLockMemoryPrivilege	952	msiexec.exe
Token: SeIncreaseQuotaPrivilege	952	msiexec.exe
Token: SeMachineAccountPrivilege	952	msiexec.exe
Token: SeTcbPrivilege	952	msiexec.exe
Token: SeSecurityPrivilege	952	msiexec.exe
Token: SeTakeOwnershipPrivilege	952	msiexec.exe
Token: SeLoadDriverPrivilege	952	msiexec.exe
Token: SeSystemProfilePrivilege	952	msiexec.exe
Token: SeSystemtimePrivilege	952	msiexec.exe
Token: SeProfSingleProcessPrivilege	952	msiexec.exe
Token: SeIncBasePriorityPrivilege	952	msiexec.exe
Token: SeCreatePagefilePrivilege	952	msiexec.exe
Token: SeCreatePermanentPrivilege	952	msiexec.exe
Token: SeBackupPrivilege	952	msiexec.exe
Token: SeRestorePrivilege	952	msiexec.exe
Token: SeShutdownPrivilege	952	msiexec.exe
Token: SeDebugPrivilege	952	msiexec.exe
Token: SeAuditPrivilege	952	msiexec.exe
Token: SeSystemEnvironmentPrivilege	952	msiexec.exe
Token: SeChangeNotifyPrivilege	952	msiexec.exe
Token: SeRemoteShutdownPrivilege	952	msiexec.exe
Token: SeUndockPrivilege	952	msiexec.exe
Token: SeSyncAgentPrivilege	952	msiexec.exe
Token: SeEnableDelegationPrivilege	952	msiexec.exe
Token: SeManageVolumePrivilege	952	msiexec.exe
Token: SeImpersonatePrivilege	952	msiexec.exe
Token: SeCreateGlobalPrivilege	952	msiexec.exe
Token: SeCreateTokenPrivilege	952	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	952	msiexec.exe
Token: SeLockMemoryPrivilege	952	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
952	msiexec.exe
952	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
952	msiexec.exe
1092	msiexec.exe
2924	MsiExec.exe
3316	MsiExec.exe
5880	MsiExec.exe
4888	MsiExec.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2924	1092	msiexec.exe	89
PID 1092 wrote to memory of 2904	1092	msiexec.exe	96
PID 1092 wrote to memory of 3316	1092	msiexec.exe	98
PID 1092 wrote to memory of 108	1092	msiexec.exe	100
PID 1092 wrote to memory of 5880	1092	msiexec.exe	101
PID 1092 wrote to memory of 4888	1092	msiexec.exe	102
PID 2804 wrote to memory of 4460	2804	DrvInst.exe	104
PID 1092 wrote to memory of 4272	1092	msiexec.exe	107
PID 4272 wrote to memory of 5836	4272	MSI69E0.tmp	108
PID 5836 wrote to memory of 4216	5836	cmd.exe	110
PID 5836 wrote to memory of 4304	5836	cmd.exe	114
PID 5836 wrote to memory of 4324	5836	cmd.exe	115
PID 5836 wrote to memory of 5348	5836	cmd.exe	116
PID 1092 wrote to memory of 5044	1092	msiexec.exe	117
PID 5044 wrote to memory of 3124	5044	MSI7839.tmp	118
PID 1092 wrote to memory of 4576	1092	msiexec.exe	120
PID 4576 wrote to memory of 3748	4576	MSI79D0.tmp	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3124	attrib.exe
3748	attrib.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Setup Ozone 8 v8.0.2.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:952

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 08861F1087F9453192D07F61A4A2A209 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2924
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2904
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B2923DEBBDD00DD7B0EFAED1063A7972
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3316
- C:\Windows\Installer\MSIBB74.tmp
  "C:\Windows\Installer\MSIBB74.tmp" 19 IC:\Users\Admin\AppData\Local\Temp\plugins_tool.msiNV
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:108
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F2DB0F34E439E861D6A4BF6175C14BD6
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5880
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B909F651088113AE17A354B4B25CE509 E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:4888
- C:\Windows\Installer\MSI69E0.tmp
  "C:\Windows\Installer\MSI69E0.tmp"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6A11.tmp\6A12.tmp\6A13.bat C:\Windows\Installer\MSI69E0.tmp"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5836
  - - \??\c:\Program Files\Oracle\VirtualBox\VBoxManage.exe
      "c:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setproperty machinefolder "C:\Users\Admin\appdata\roaming"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:4216
  - - \??\c:\Program Files\Oracle\VirtualBox\VBoxManage.exe
      "c:\Program Files\Oracle\VirtualBox\vboxmanage.exe" import "c:\vms\tmp\sys00_1.ova"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4304
  - - C:\Windows\System32\xcopy.exe
      xcopy /Y "C:\Windows\System32\Config\systemprofile\.VirtualBox" "C:\vms\.VirtualBox\"
      4⤵
      PID:4324
  - - C:\vms\VmServiceControl.exe
      "C:\vms\VmServiceControl.exe" -i
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5348
- C:\Windows\Installer\MSI7839.tmp
  "C:\Windows\Installer\MSI7839.tmp" /RunAsAdmin /HideWindow c:\windows\system32\attrib.exe +s +h "C:\Program Files\Oracle"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\windows\SysWOW64\attrib.exe
    "C:\windows\system32\attrib.exe" +s +h "C:\Program Files\Oracle"
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3124
- C:\Windows\Installer\MSI79D0.tmp
  "C:\Windows\Installer\MSI79D0.tmp" /RunAsAdmin /HideWindow c:\windows\system32\attrib.exe +s +h c:\vms
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\windows\SysWOW64\attrib.exe
    "C:\windows\system32\attrib.exe" +s +h c:\vms
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2044

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf" "9" "4e41c48b3" "0000000000000130" "WinSta0\Default" "0000000000000184" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6"
1⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{ED6A04B0-F090-4738-AA4A-900164BD6B6C} Global\{2F1292B7-2064-4415-804C-408EE1EC296B} C:\Windows\System32\DriverStore\Temp\{000f3531-6ba7-0e45-a2a8-e6a8ed56b6b5}\VBoxNetAdp6.inf C:\Windows\System32\DriverStore\Temp\{000f3531-6ba7-0e45-a2a8-e6a8ed56b6b5}\VBoxNetAdp6.cat
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4460

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf" "9" "42c633047" "0000000000000184" "WinSta0\Default" "0000000000000188" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3604

\??\c:\Program Files\Oracle\VirtualBox\VBoxSVC.exe
"c:\Program Files\Oracle\VirtualBox\VBoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2104

C:\vms\VBoxVmService64.exe
C:\vms\VBoxVmService64.exe
1⤵
- Executes dropped EXE
PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBoxNetAdp6.cat

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\network\netadp6\VBoxNetAdp6.cat
Size 16KB
SHA256 5ce0e441c1af1fd6cb78d0a1a2f18c329be171c0f15f15bdcabf685bbc762549
MD5 ad3a6e2d0ada67d8253e802ab3514e5a
SHA1 53503dd37277f3432760e91742502a76319bdc9a
SHA512 7513e98b15f44086f0c4a1fdc65dbd82a579ecbd02eab28debcedbb434f4b7fbe5e351232db1cb3ed245c6b6ecb5c245cd35c7fdc55d44eada9429aeb18dd32e
SSDEEP 384:gnYPLdUHeMDIIIJOUyDD5JNNzFwhhim6I:g2IIJGp3whT6I
TLSH
T1C072F8DB0E2D6452EECBDE9191C5D26B9C30B7E26DC458AB107AD2815EC2FE13B4D40E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxNetAdp6.sys

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\network\netadp6\VBoxNetAdp6.sys
Size 208KB
SHA256 1b00cdcc40fc1edff68df26a062469a41f0048e148cc3b73d791bfe6e124bca2
MD5 8df0fb7a43e52dd313b340f8a25bcfd1
SHA1 cd7abd30a2312ab2921f4efe003ed170901f10ac
SHA512 44a81cc9ab23b7f8c1b9d4a3a2c81a546d8980f6d31af5977eaa3e9e6362be482b229a84233ba57b230dea636800663049da61a3cfef0c4c787efbaecb02447a
SSDEEP 3072:fcO+Xf78l7WAfejQfnC+C9tfivasmnpKw1zOEP4vBq+IfZwNCVkW692xJh:fcOq9fjsmnR1qEgpzsVyaz
TLSH
T1B8246B53BAC839B6D59F523688924A4AD277B8920310C2EF175162E6CDD3FE31EBD704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxNetLwf.cat

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\network\netlwf\VBoxNetLwf.cat
Size 16KB
SHA256 3374c60dcc434438a3f3d717cd71dd13a1218b93b9f0449aaa24bacd3c7fc0b2
MD5 5c610c4f3541fe5450e23dae1f1c307b
SHA1 c64b99204476dd10db05bbd246ae634491e74900
SHA512 039d409a0b61f69cd5e059f99454527b90c7a09161ce96c62046b0b3d622a55d749e102e0185fb9ae19b2219533b41b82bacb976eab51ba04938028178ab9269
SSDEEP 192:Y9jy8znnYe+PjP6rr8JjtlAur9ZCspE+TMwrm6Z1QGnKy9cclPJwBjtlA8wH0JOQ:QnYPLdUHeMD6ZqzIJOU85JNNzFwhhi/P
TLSH
T12172F9CB0E2D6452EECBDE9591C5E16BDC30B7E1ADC498AB10B6D2815EC2FD13B0941E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxNetLwf.sys

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\network\netlwf\VBoxNetLwf.sys
Size 217KB
SHA256 c0803ab53637fd9f391d488a9a67efc308ebd0e179a93cbc3cd4d9e27beb9cca
MD5 abb7120fd153f484ea1fcd4ec35907bb
SHA1 b721aa821a13fba9380d4cef21107cd9f9e73500
SHA512 4b2896c0b4fc599c3616c8c26a053ce4972c60e33de574f3523410e73414e5473f523aa729150d23f68c7aee90150da9849342abf5401fca0c80df941c7907e9
SSDEEP 3072:YjqVoIgoCfFSjIfnLXZr7M+cct7E4mnpKz1zHCpmjVZwreWopXrJo:Hv47xE4mna1upmjT1rC
TLSH
T1DB247C57BAC439B6C59F82364852468AC3B7B8660310C2EF1351A2B59DD3FE32DBE714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ozone 8 Vintage Tape.vst3

Path C:\Program Files (x86)\Common Files\VST3\iZotope\Ozone 8 Vintage Tape.vst3
Size 2.3MB
SHA256 4532be392ce0d77fb0a2e53995acdf80a0b03079f7adf8f5444cddf124060153
MD5 586b1ffe1c8aa03fb849acc9d62115b0
SHA1 1e1c430f5ac89d094b6a26104b3d5c72d4bf0335
SHA512 8aa08e4092392e646cfe99f0534bd33f3595e3d937dd11cb2b171864c72cf86dea3b8c1e26a12b08c5f50f7f75dd82db4e6237568bf433f24189c4d363f9ef7f
SSDEEP 24576:I9kns9qZqinFaDHutJwuhKFvaKFvwKFv/vaJZhRxf3ti0Jgyzan5wwm5wwm5wwmv:SHumnyMf0RdTDrPWjBs7wU3m8
TLSH
T1A3B59D81E4D3D7B0C59809B0293F7BDA59345E9D4BAC4BF392D03D2D8CBB9C016A3A56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ozone 8 Exciter.dll

Path C:\Program Files (x86)\VSTPlugIns\iZotope\Ozone 8 Exciter.dll
Size 2.3MB
SHA256 57a8d859686511e1a1e80da9dad892a4c692d5e73304342075e550dff2626a90
MD5 112ab9d3b32363cf893bfc41489da832
SHA1 6d108af0ba19818dc233b7abd4a9e35e7d1a7388
SHA512 45ff27b0c86b6b18013b8da834ed77dd5e9c03b41a29c1ece85e3d7814422504ed09325d3a1e015c02641ab07d09d885f7509fd58cdfb818fb819b789bedbb79
SSDEEP 24576:Q9kns9qZqinFaDHutJwuhKFvaKFvwKFv/vaJZhRxf3ti0Jgyzan5wwm5wwm5wwmd:6HumnyMf0RdTDrPWjBs7wURm8
TLSH
T1C5B59D81E4D3D7B0C59809B0293F7BDA59345E9D4BAC4BF392D03D2D8CBB9C016A3A56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ozone 8 Vintage Tape.vst3

Path C:\Program Files\Common Files\VST3\iZotope\Ozone 8 Vintage Tape.vst3
Size 3.0MB
SHA256 87486edf1cabd66676e27b276fbe08b5f097f163d65d066a45022e5558c8b0b7
MD5 f0a60150be7b30ca65036358f28d3484
SHA1 1cb902894182fa9196bbda02ae79467f945494e7
SHA512 810cb37e38a55ef88be4313cf9d02663a13c76d8ea4c5c889890dd6de19eb856670bea312769c5d19321254d1d22fb2852743e075029d02d71a920a47445011f
SSDEEP 49152:rIqXOXmPqYCQCVCpGzGsCouebAnQiP0N7FT0+BgreVJNIY:rYdAnqfBuU
TLSH
T177E59D86E4F6A1E9C512807556BF3646BD23384C076C2EF341E676381E7FAC02A77E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxManage.exe

Path C:\Program Files\Oracle\VirtualBox\VBoxManage.exe
Size 1.1MB
SHA256 1501aa7411b32e9cc68aff391e7ff81ec515182456edf0d1999ef1633c64fdbb
MD5 44157a6d6548989c1255b08c85393641
SHA1 bdae3dcc5c4a1b5b657fa6f8af856f70fe2112b0
SHA512 63fde9f6af8f17d00859d9e3f24c7e1192a5fce1f9cc01832ead0e367b67345ca2980358ba4fbc9b7ec6a42206f54586f3ef3fb8e16974d8a392113d783005d8
SSDEEP 12288:25mRjk2aj9nnfC3I5jq+EsTpFq1vThYZ9bxTo4cNdJF53MQ0/mfzq2wid:25IklfEI5LTzqNhY7bxToTdJF539pd
TLSH
T154356C27AF784190D475C03A8DB66213FBB23449173097E7798D9E2B0F27AB69D39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxNetAdp6.inf

Path C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf
Size 3KB
SHA256 e8d0afbfa64f52384af95a632e35b002cede1d84dc8bea42daff3942e0f3b391
MD5 5a4247dadcd00874c579d605ce64219e
SHA1 33949ad3f41b72140097b78e0d21903c2c28a8b4
SHA512 1ce707b4796e93c532be5b660f42fe7341639b83bcd1a7599e3fdbdab677fcb8d45ef748f97aae1d4436b6baa1ab4c387c4f21401ed8149f1b838c5abc43af10
TLSH
T1A26130BA64B11733DE33144A9F4A59C3B724008738AB182575AEC97F538ED1C537E9E4
MD5 SHA1 SHA512 TLSH

Submit Download

VBoxNetLwf.inf

Path C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf
Size 3KB
SHA256 9f0536e1002f5b7bd12946dfbea065d6a141061518ef0c6e25c6c9b65c6e4cf6
MD5 ca51d8c7d4fbebf19726f0e8a25ba85e
SHA1 58857f2c6256b005b348972022d3b23fc1398b2f
SHA512 c853c981eac5e79551f11c29f74b06f99a4f00fa259aef709f41bec26e4ebdd5c80c20d55158bca784a34dae8c2740f1d9707a95f1fbd73193d5a932e71ff4b7
TLSH
T11481855A45B12F711D42644AAF461E86BBF9004305AA2868B5EF89F743CED0C32FDDF4
MD5 SHA1 SHA512 TLSH

Submit Download

VBoxDrv.cat

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.cat
Size 16KB
SHA256 d78734d7fd3e50166dfb02a71f87e6171d6a29c530ea731c8940fca789f14b94
MD5 c77e30b8e9c1c58199f31b483847c1c9
SHA1 7fec5776e5ff8b91c624db61fdaa648a05638eb8
SHA512 510bc6652d0da32460e232935b625c94fde6c96093b2dcbe049ba916a977bec86f9cac1e637b8845991e993f2fcec0a8d48562a77dd234baca892311e7117838
SSDEEP 384:mgnYPLdUHeMDB7oWIJOUSTR5JNNzFwhhi2Z:mgvIJi3wh7
TLSH
T1A97208CB0A2C6453EECBCD9192C5D26BDC34B7E1ADC448AB50BAD2815EC2FD13B4940E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxDrv.inf

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.inf
Size 2KB
SHA256 69acdf87395b541c113337b2658b6047ffcdab462f2287ac88441312ed2fbe96
MD5 10ea8fc160345326b48af0b6a2cbbc04
SHA1 f9c435d557ae6e53a27ae62dbdc1c1b4e3fe5c74
SHA512 b75700148420698fb34a2c445116c9255799f77b9b81e1f4d2cead5b6e9d41ad35f759f5c5f7212bbf949ba40654659b079fa3c2d8c5db508c857748068402d3
TLSH
T1BF51628981C0477179375956178F9AC3F3E5122418EB902071EED834535EF2CC3B19FA
MD5 SHA1 SHA512 TLSH

Submit Download

VBoxDrv.sys

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.sys
Size 961KB
SHA256 0a889cbdf5e35ac3f02342d89ab812b82fa1660f55b2af0d08724337db0526ce
MD5 f2b8d6914a4f1edded7dd49d66afce7f
SHA1 d3339203528fa272f010b0c8746162062f7bcb4a
SHA512 a12b7ce774e0566b0dea70adc816e80fb7becc774ca5925b8fd5aa43a1bf0f3d97e0ba4b35f65a9aae3b7bbeb05d029cebd68f30c9936ce221023ba4f90c6f6c
SSDEEP 12288:1npzwQTdZ/QkGapOwtDDDqnp6F0SMcLnKDoEeAyI:fwQTQZaDDDDqp6F0iLnKDWI
TLSH
T111259DA6B69819F5CAAF9239C6915607D2F234410720D7EF0AE086B53D97FDA0F7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Program Files\Oracle\VirtualBox\msvcr100.dll
Size 832KB
SHA256 cc2c2848bc601170539e579de62575546bddec5dfa600aa0b32eedb7d664de20
MD5 63519a5664d75ab339fcd7e20e102a28
SHA1 60f13c73418532fa4bff24984f741b46a9d6dc49
SHA512 9ebe85096ab93e7f91ee910a6568278658acdb7b85837db5841a63b157f06dda4fd5edafc84a25e05dbff354d4640c5ce2a7b8b9db7ce06176cfe60a9e6934ae
SSDEEP 12288:NgzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGoko+/Q:azJetPMw9HfBCrMb2Kc6ymyyKWewGz8
TLSH
T184059D9536A906F6D137D63DC996C606E2B2741517315BEB01A04BAB2F23FE09B3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ozone 8 Exciter.dll

Path C:\Program Files\Steinberg\VSTPlugins\iZotope\Ozone 8 Exciter.dll
Size 3.0MB
SHA256 55bec231b7c22f3b787e54918201dbaf2ffcada9f21cff7887131631eb219fc2
MD5 e977e41c909e59ed523898cd6d5677ab
SHA1 183b964aafa6d2be9662ebf19ac440cba9c72b02
SHA512 25e0e8f96df3207559040e43fbb9524f00ed7ec837bff284cfc3401dda961d5ecbd0cf656df6f36c41da9926fe5dcba2f7a3060132237d9fa74c602ee13530cc
SSDEEP 49152:bIqXOXmPqYCQCVCpGzGsCouebAnQiP0N7FT0+BgreVJNIY:bYdAnqfBuU
TLSH
T1BAE59D86E4F6A1E9C512807556BF3646BD23384C076C2EF341E676381E7FAC02A77E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6A13.bat

Path C:\Users\Admin\AppData\Local\Temp\6A11.tmp\6A12.tmp\6A13.bat
Size 431B
SHA256 b6d34fc405916c01e421bd4e624d5130b5a3174d98641ac0f3bb479a9cd43ab9
MD5 e3bcfb80776891be0a67ae07c1f29005
SHA1 b307f35e42072ccf20e51b265f739712474dd673
SHA512 b424f3764bfeaf597d4abfa86e451ce6fe5264f78743ffa8149fa5503f07f3290ea4e1fa236aac41a5af536d962cf08e861b4d25a5afcfbfbd81cba4734349a3
TLSH
T15AE0A34A5251BE011047ECDEBBF55EC2D837D2493BC54B513390064DB65649D24C6C1F
MD5 SHA1 SHA512 TLSH

Submit Download

MSIF5C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIF5C0.tmp
Size 337KB
SHA256 1cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d
MD5 dfe7442a09a0809f22e0806040a0202e
SHA1 e6f76a86fa46e8e2c659c1c326457e6eb6b253f6
SHA512 331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197
SSDEEP 6144:XRk+8r6fC+fXQMpCNZABJsRrD6ZAOXtAQgxDVkQ:K+8r6ZQMpsZwLNtODVkQ
TLSH
T1CF747C2176D6C837D6BF0DB03A38DA9A402D7E649BF1D4EB43E80D5E09724C35639E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpu.PNF

Path C:\Windows\INF\cpu.PNF
Size 18KB
SHA256 29549d08eb8bc57a5feebd9b73900fdc05187f182aff2f32c712ecf728d2ed24
MD5 731107570a877a40f1d2d8e6e34e5de5
SHA1 4c05509fae5825c41ba0b8380f422156605e487e
SHA512 c365d5544dab8718f87d0912524daa2c7b26e8e40d48b8a38734b6b87262b8c4e448b35ad8c4a9396889b011626cf13e776baff4018d24d50713c51860ba55df
SSDEEP 384:9iF5rs1w0jZysKo7/ZFaruCpwmWuoBVd1aTA+Zrq9D1GD7oiYI62kYuptzyShf2v:0jr+LCGMfqppX6tSW6PvPQwhBhiCif7x
TLSH
T19C82AB4172EC4F25F1B60E706EBAA0E5886ABED16C12C71F2160735C1872FD5EEB1726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disk.PNF

Path C:\Windows\INF\disk.PNF
Size 16KB
SHA256 9c23b378297326de5b1c2977f0c2a09c494c9eb25c2e66ee3dc8fcc03905b8cd
MD5 86bf7bcd60c5b1c2b0b0a2486ae72f59
SHA1 7a2a6ed1bc36a0824e4c71e51785d759e3e91850
SHA512 0974115068807bef45edeb7eaa99d2217d3d0fe096b5a7ead92c0ce2726d8ec6eed6da4652965ad15d7db3f304fcec3ce71d64514ae52da91a1794838ec8854b
SSDEEP 192:Dz2n//uIsmr+orMYzR7QN8kNWcY9WugffZw1jt2Asqr3RqTT9M4IA2uhULOt:3tId+oXzR7QN8kNKgBP9I1uhULOt
TLSH
T10F7223A17BD9CA14F4F2AE7AAEF551D644257CC19C02DA8F6460731E4C33BC0D6E1B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

termkbd.PNF

Path C:\Windows\INF\termkbd.PNF
Size 7KB
SHA256 766fa9a10f6de5df3dbad18f966d5f1da7ccb1b01615ef49fea8437fba5abe0c
MD5 c55c22c63ca995eb443502db07723eb4
SHA1 198c51cd5e597db448c0eb252811e522c0046272
SHA512 828d3542b739058888beba765ad3ec7789c98c65504c8ac650449f154070c696cac0b6019d3ef24bc5944d482bb69d2165fbcc3cebfafb83a98c10a82c141f0e
SSDEEP 96:3taClKQhqUnokJb0e6Mt+PRD+dmI69tjR0FJM8P1i2LVBNNg5:daDu+kJbgMcPt+dmI6/kNN+
TLSH
T118F1124572E98F19F5B26EB05DF060E608697C92AC11CB1F3264735E1832ED49BF0B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI235D.tmp

Path C:\Windows\Installer\MSI235D.tmp
Size 107KB
SHA256 16c4cf37242385f27d2625ee8b660b745342ef8340541e6c7e4673522ed13956
MD5 cf6354b5789cb6b9691b8896e255a378
SHA1 e9429ffa42b00f45073fa1989f92c2c27d7aad86
SHA512 7ba049a5ec80d94763d44c7cdc85d2e94b4edfe5db2ce575d594e4914f321bbb730f60b33f2ff9f58f359ce4f4b35dd5efbaad670c30c31dd836735110776202
SSDEEP 1536:zCDvWcAQcnkygLVSA10DUXqUWqJ76Yjfx6Luy/ViX:DkyASA1CUdRLTy/QX
TLSH
T115B3F915BFBC0029F1716A3E95E25528E1753D822B3187EF2D02A7DA1E37AD58436F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3A42.tmp

Path C:\Windows\Installer\MSI3A42.tmp
Size 650KB
SHA256 07694439a93f220f5e9f46ac3ceb0b22fe1dadb3ed9bf18a9f2835be7a5c3bc6
MD5 6aa987dbea3f424fa44cd541dbae7368
SHA1 47ba276719f0a3e25e24fb546ecad8b97b6ebe67
SHA512 c5c5901bcdfdb413cb679d39c90a4fa64e96ad10d25476c62e2d2276bdc1cf8a5b4d987f881acb701ffaaa22662b64442e399f1aa8cb6ff5c761e03c474756a2
SSDEEP 6144:R11HMbt9eFVmIGccehSleghteGzRSDWFQ//fo4CyRg5Sy3rRsaCUhsm27QE:w5cceNKt7zRy/zCyas8ROUOVb
TLSH
T185E46514F9B80525E163997FA2A29E5DD17239861731CACF0302DBF61D3B5DA8632F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI69E0.tmp

Path C:\Windows\Installer\MSI69E0.tmp
Size 120KB
SHA256 bc6009a3a842c5782135822defe5f81cd93228ac91bf44041eb01683b6611b49
MD5 311c52c61e1b78c8a91e578318409da2
SHA1 f4897cb778779e21f1bbb6416f1387458401afa3
SHA512 c99970e9854bc5c7cca946af538f38e63c6496d4de7500c94e21b4349bc79ec605d34ec3516f944f7850b698276379be639a4a7965c1d53ed8b71135bdca7239
SSDEEP 3072:+2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcXKJ:/bJhs7QW69hd1MMdxPe9N9uA0hu9TBLJ
TLSH
T13CC3396AB2E01198DBB581F6D9921706EB7074321B15A3DB5BB853B31B2B4C68F3C3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIBB74.tmp

Path C:\Windows\Installer\MSIBB74.tmp
Size 195KB
SHA256 e8d7e531c82777c8d5df06f1620abe6553e162b82332198a2854c576993ca12c
MD5 df08a8afe035f33067d1eb34c1a055a0
SHA1 72a707e305d40e8dcde9c31a9ab36297238aeb64
SHA512 87dd3bdf99d497126e6ea8647d2fac18ba6277b69e696465e4382f27ee8b790ac05a2ed704a5defbd56aed011d3105bef4d016803feea862732d6983399370b1
SSDEEP 3072:CBWSL1NOrQsUNEbdzorgK5n4aqcgxfPJ4ecOOwxwZOAg0Fub6RpI1Ubs/7BFNis:CISL1NswEbdbagx6CAO+bRg/F3t
TLSH
T19514592039E3C472D4B2093119F89A76596DFF700FB159FB13D8872D5EA42D20635EB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC6FF.tmp

Path C:\Windows\Installer\MSIC6FF.tmp
Size 246KB
SHA256 43d37b1804e16196f3d7fc69646cc78d6dc30253a51b9296d86d123c8d8a6172
MD5 84df8f04cafbe1e18b46d4c8729b15eb
SHA1 3c0225aa16161ccfe207fe3ba985a0ba9c9dd2a4
SHA512 a0255830f5cc9ace1e91b968c85cf7e3e322ebdaa27598403008abf01527a58d0bce79857db81702133f8b9582d7dd31c5f675108e48771561ae3c43f63c9ed1
SSDEEP 3072:A8bYc9TDBWFG2HWDUvYHdQLM1IYSAPCQuKLzVkYNDRt4qb/IOAg0FuboibZyf1Hp:ZYjpLwIYZCQu6nAOcXlkiZC2
TLSH
T13B347C507592C136D5BF46710A799F6A84BCBA648FB0C8EB23D40E6E9D319C31A31E37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iZotopeOzone8_1.exe

Path C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\iZotopeOzone8_1.exe
Size 373KB
SHA256 7cba1c990bd8533351be471f59223bf25754170aee77797c598db0d6baf95725
MD5 eae615d3da6b59e28d9fc2a41b0f426e
SHA1 a204d55f0496a1d04b3a8380d00cfff70ab605ad
SHA512 dffdd5cde7ac9eaa72d3a3344ae80b3424e34080e0113374fae2740f254507cefba2927b328f24226c692ffed3e4335a23463c814de97ebd0502a54ee940d10a
SSDEEP 6144:kbLXuPumdJCkIDZbIj8GZe/1MocnS1AJwFVerzoVP+mNg5iUcHxWZ5sJwO:kPX25dIkI1kj9KVcnSRSIVpNJUKWZ5w/
TLSH
T1CB84234EF669C873FD8372750B45CE303BB96D53A130587940C86863BD8A676A4E163F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 71KB
SHA256 7322c53ba91d045008512110dae32b115990d9c35c39e3b846f10a2fee86cccb
MD5 ed7f106512092486663c85a9d525a551
SHA1 d61c9dc61500cac800c1a60f8f059589d4369eb0
SHA512 f5f87cc0b07c0f5baae43231c329f7782a930c2421f5fa39c9ed931f331c7c9c3eecf92a5b041afd591af2c81a30f4cfba11e5cde7e28dc2ab9086e8367ca6c0
SSDEEP 1536:EpLcY3LRHXgNY+YGTAkZkIPvQTuGsVCBEs/9WaWuP6sLBKexBoxbf/oNw5JwN3d3:iogO6
TLSH
T13F732B0580DCC649C9F619B27259EE71D93A6A9E770F4EFA30EC53409AC2F042F7A179
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 71KB
SHA256 e32b2e7331e4289251a678fe0010330b1eddc89c5e572dcf7ef85be9777a5458
MD5 04a0384393caab4bd45ba6e3a0a6b332
SHA1 ab318d7d0652ad66218ccdde6e621949c896c7b8
SHA512 ec174b46cbe4e5153f7bcee4fd4edc31b9734f5e02e3ae1c9bcacce29cb3f3a5192092516701ca0fbfd1a59cb9f47a56bec1b05cf8bccd40a1faf5f5cceae177
SSDEEP 1536:EpLcY3LRHXgNY+YGTAkZkIPvQTuGsVCBEs/9WaWuP6sLBKexBoxbf/oNw5JwN3dl:iogOi
TLSH
T1CF732B0580DCC649C9F619B27259EE71D93A6A9E770F4EFA30EC53409AC2F042F7A179
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 71KB
SHA256 bc2756a223ffca75e9e6598ae68ef2ce60022e9c7eb3ee8814c5c3d7776af91c
MD5 f68ca60c0771e57c0ad0836815e30da2
SHA1 feba6b97bcfdd37d967f831008dea16df3207d2a
SHA512 dea34997e8a527d7ed31161f6a353a8b5cd9967a558f9bf7d3ff4f06a946c556b33e438a0f5f800d57da5349d1a414dbdd18178818c89902943bef5752177b3c
SSDEEP 1536:EpLcY3LRHXgNY+YGTAkZkIPvQTuGsVCBEs/9WaWuP6sLBKexBoxbf/oNw5JwN3df:iogOK
TLSH
T199732B0580DCC649C9F619B27259EE71D93A6A9E770F4EFA30EC53409AC2F042F7A179
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vboxnetlwf.inf_amd64_9574bab5159a1997.ini

Path C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9574bab5159a1997.ini
Size 429B
SHA256 22bb4dc16ad0e2cb77e2d9c2f3a5b6891cf8b5cb997f91d418b97e013130a35a
MD5 9782734ed18d5e706850e153cbdf10ed
SHA1 6abb5954591095ce6aab1bfc8b6f2c14527708ed
SHA512 7a3a76a1f803f0e56d5067ba5f2ff029940b15c2f6de1a03a6639578a7a536c289e023423ab5194604e1bb3c1d16568b70de9d01c09bc81576471e1494178566
TLSH
T160E055C608B48BECBE07AA07AF2DC302C83992AB2713BC1523E0C1801F958943288187
MD5 SHA1 SHA512 TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 71KB
SHA256 e23d5133bfecdf929a1c3103042ab255538b50a8c847a8fb23ee5943cb3618c1
MD5 0e41280001bc504d3b0da9a43988b5b7
SHA1 d11281fe63f4342092563ff9e8e9b5bc5f9d086c
SHA512 0b08a267d79898dce07f064714e690aba20b04cd28785a47da78eabc4d1f4b465bb5346d3dac2753d564e9aa73a2890b23e522e6bc2e8acb910d1072c13791e3
SSDEEP 1536:EpLcY3LRHXgNY+YGTAkZkIPvQTuGsVCBEs/9WaWuP6sLBKexBoxbf/oNw5JwN3dG:iogO3
TLSH
T11A732C0580DCC649C9F619B27259EE71D93A6A9E770F4EFA30EC53409AC2F042F7A179
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 f9fd65ce173c5088e1731a375d7a4a6cda8b53caa75188e45c8f0641755cf84f
MD5 ecbcb30dde33f5d993ba4f2c6275edaa
SHA1 57e79a0e2d385945a4082c2013c5761a86cf3a36
SHA512 e1a862e72ddde875a77a28a645eb14e38fa263879e9db0d2b00699ec8be2356e3153934d46d3d0032a0cffd477eaeb9b9f55c640cb497db52ececfe1fe223887
SSDEEP 24576:RFo3DMPMdoO/vvTL/ig//ylAPL+1UrYc0CZNtSxHpKRa5oOvcYh2/mV+bu/:gHY
TLSH
T17057A32537F92210E7B79E3CACF0AA2349397D5B9C16DE8D45411B4E0821F71E8B2F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{dc195a8a-da1b-4555-af9a-3d40ece3e245}_OnDiskSnapshotProp

Path \??\Volume{e70967fa-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{dc195a8a-da1b-4555-af9a-3d40ece3e245}_OnDiskSnapshotProp
Size 6KB
SHA256 76fd4bbb3f2655d432c268402cf5bd752afc7f9b40c0de2fd384441392c55073
MD5 2ef599b2e66b6bd6ac19fad7e4fbf950
SHA1 03593e72f91efd999cca60ee6e023e5b4f3ed6fd
SHA512 cdd07f9c1dae92726bdee2d0f5442264622587dc8ca904b64395ea51170aeb84dd67cd8a876647f6e52121c354bc2325aa9b0549a54b332fc0e8a0e8f1cd3d26
SSDEEP 96:FM0WXOqvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:VWlb++uVm
TLSH
T1AFD188185AF54711E2B3AB3129F18557A477B911EF33CB8E0198238E2631A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP100.dll

Path \??\c:\Program Files\Oracle\VirtualBox\MSVCP100.dll
Size 612KB
SHA256 4406a2d05ed77d581784daf1aca549ad1507184b49fe6d869a77c8e0990d08ee
MD5 c9e7658434cc2562124a63c679157c69
SHA1 7a8d9f2d0585655dcf7558b40ba5e6a37a1e0447
SHA512 0d04fcc80ef9629baa4c2605b8c821056bc4645c5197be0e3a07f65a2e336341ccafeb0c483f2dd81ce69aa518b517ee934449b3c8bd5e930162208996166e68
SSDEEP 12288:foBFUsQ1H5FH3YUTd/dfePA7XrNvEKZm+aWodEEGblHG+:MFUsQ1H5FHdggrNvEKZm+aWodEEIHX
TLSH
T1FED42B23FB2906B0E162D37C64C6C341D7F13C8A4B22A7C752ABD52D2F67AD9563B121
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxDDU.dll

Path \??\c:\Program Files\Oracle\VirtualBox\VBoxDDU.dll
Size 401KB
SHA256 a50e810403c00272b21c7a4debeab29fd8069e59e7d2fcb6e71fd5e691687c31
MD5 06e40bdf0196c05ac38a6008a23bfad1
SHA1 c0369424eb4e287ff897742778d1ca8b261ed80b
SHA512 5276f8c49ffd81081cb2de3e5418f8b863e371005ffe62200c910b61c6916283fa1e8e697469c8fa066f01a6cb32eb5429c2bd55601c09998fccd1a88b9c2b42
SSDEEP 12288:0ZWTUsLlHhAztQnF1jgFP1jYQfuweKvypdLNSPr:0kTUsXAzcoLf3eKvypdZSP
TLSH
T181947C83F7B500B1C5ABC13895E78A66E7F6309813446BDF0A6483561B23FE6B63E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxRT.dll

Path \??\c:\Program Files\Oracle\VirtualBox\VBoxRT.dll
Size 5.6MB
SHA256 e96d1d80fcdfe567a2e6bcccd3cc80a85c5135dcf0e528a88efa6aa7d2252c7e
MD5 e99f602d47e48c8b783b42e798ff064d
SHA1 509aef6382335b97723277f5a8fb1d4aa7feac41
SHA512 91321e2dbe70e04aa40213f05ee1a4da5f287e0f9a285d672ae2dbe9ffc93731981e855b8bb5e61a19b07d3fa42de94cb4bdeb0a8f047ee559a9703e5f086da5
SSDEEP 98304:ZTc8ypJMVoe5kqanQXT5Gu5Urnauy784C:tc8ypJMVoe5klQXT5Gu4nauyAD
TLSH
T15E468B56B2D021B9D1A7C179C6974212E3F270680370A7DF61E4CBAA2F03BE6563F761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download